Cyber Insurance FAQ
Get answers to the most common questions about cyber insurance for small and mid-size businesses.
What is cyber insurance?
Cyber insurance (also called cyber liability insurance) is a specialized policy that protects businesses against financial losses from cyber incidents like data breaches, ransomware attacks, business email compromise, and network intrusions.
It typically covers:
- First-party costs: Your direct losses (forensics, recovery, business interruption)
- Third-party liability: Lawsuits from affected customers or partners
→ Learn more in our Cyber Insurance Buying Guide
How much does cyber insurance cost?
Small businesses typically pay $500 to $5,000 annually, depending on:
| Factor | Impact on Premium |
|---|---|
| Industry | Healthcare/Finance pay 2-3x more |
| Revenue | Higher revenue = higher premium |
| Security posture | Strong controls can reduce premium 15-25% |
| Coverage limits | $1M vs $5M affects cost significantly |
| Claims history | Prior incidents increase rates |
A typical $1M/$2M policy for a small business averages $1,500-$2,500/year.
→ See detailed pricing data in Cyber Insurance Cost 2025
What does cyber insurance cover?
Most policies include:
✅ Data breach response — Forensics, notifications, credit monitoring
✅ Ransomware — Payment (if elected) and recovery costs
✅ Business interruption — Lost income during downtime
✅ Legal defense — Regulatory investigations and lawsuits
✅ Crisis management — PR and reputation repair
✅ Social engineering fraud — BEC and wire fraud (often sublimited)
✅ Third-party liability — Customer lawsuits for exposed data
What is NOT covered?
Common exclusions:
❌ Acts of war / nation-state attacks
❌ Pre-existing vulnerabilities you knew about
❌ Intentional acts by employees
❌ Bodily injury and property damage
❌ Failure to maintain promised security controls
❌ Some policies exclude cryptocurrency losses
→ Read about claim denials and how to avoid them
Is cyber insurance required by law?
Not in most states, but it’s often required by:
- Business contracts with enterprise clients
- Industry regulations (healthcare, finance)
- Vendor agreements when handling sensitive data
- Loan covenants and M&A due diligence
Do I need cyber insurance if I have general liability?
Yes. General liability specifically excludes cyber incidents. It covers bodily injury and property damage—not data breaches, ransomware, or network failures.
Some BOP policies include basic cyber endorsements with very low limits ($50K-$100K). For meaningful protection, standalone cyber insurance is recommended.
→ Compare: Cyber vs General Liability
What security controls do insurers require?
Most carriers now mandate:
- Multi-factor authentication (MFA) on email and remote access
- Endpoint detection and response (EDR)
- Regular, tested backups (offline/immutable preferred)
- Security awareness training for employees
- Patch management within 30-90 days
Premium carriers may also require privileged access management and 24/7 SOC monitoring.
How long does it take to get a quote?
- Simple risks: Minutes through online platforms
- Complex risks (healthcare, finance, tech): 2-4 weeks
The application typically asks about your security controls, IT infrastructure, data handling, and incident history.
→ Get quotes from multiple carriers
What happens when I file a claim?
- Call the 24/7 breach hotline immediately
- Insurer assigns a breach coach (attorney) to coordinate
- Forensic investigators assess the damage
- Legal counsel handles notifications and regulators
- PR team manages communications if needed
Most insurers have pre-approved vendor panels for faster response.
→ Understanding the claims process
Can claims be denied?
Yes. Common reasons:
- Misrepresentation on the application
- Failure to maintain promised security controls
- Late notice of the incident
- Incident before the retroactive date
- War exclusion triggered
- Known vulnerabilities not patched
Being honest on your application and maintaining your security posture are critical.